|
dexX7
Legendary
Offline
Activity: 1106
Merit: 1026
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2014, 01:08:59 PM |
|
Trezor has very low power consumption, I would be very surprised if that's the issue...
I bought a USB powered HUB + a new cable, now it works flawlessly. ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) hmmmmm ![Wink](https://bitcointalk.org/Smileys/default/wink.gif) works it with the old cable but with the new active hub, too? I can confirm this very odd behavior: Win 8.1, Chrome, Trezor + original USB cable is not recognized Win 8.1, Chrome, Trezor + Nexus 5 USB cable is recognized and workingAnd wow, this is a cute and nice little item! The finish surpassed my expectations. ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) Edit: maybe very important: The device becomes quite warm within a few seconds with the original cable, which is not the case with the other one. Here is the heatspot: ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FE06ccrh.png&t=665&c=YaRJl995JCU2FA)
|
|
|
|
dnaleor
Legendary
Offline
Activity: 1470
Merit: 1000
Want privacy? Use Monero!
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2014, 01:53:26 PM |
|
i also tested the exponential waiting time when entering a wrong pin number. Confirmed working. Very good! ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif)
|
|
|
|
stick
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 08, 2014, 10:22:59 PM |
|
I can confirm this very odd behavior:
Are you using USB 3.0 port by any chance? Do you see the same behaviour when using USB 2.0 port?
|
|
|
|
dexX7
Legendary
Offline
Activity: 1106
Merit: 1026
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 08:27:28 AM |
|
Are you using USB 3.0 port by any chance? Do you see the same behaviour when using USB 2.0 port?
This was tested with USB 2.0 ports on a Dell XPS 1645.
|
|
|
|
carbn
Newbie
Offline
Activity: 3
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 02:00:37 PM |
|
Chromium in Ubuntu 12.04 just updated and the old plugin stopped working. I'm not switching to firefox for this, so when is the new version coming out?
|
|
|
|
stick
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 02:05:09 PM |
|
Chromium in Ubuntu 12.04 just updated and the old plugin stopped working. I'm not switching to firefox for this, so when is the new version coming out?
When it's properly tested.
|
|
|
|
chrisrico
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 04:11:21 PM |
|
Chromium in Ubuntu 12.04 just updated and the old plugin stopped working. I'm not switching to firefox for this, so when is the new version coming out?
You know you don't have to switch to Firefox, right? You could just use Firefox only for MyTrezor.
|
|
|
|
Perlover
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 04:42:59 PM |
|
Dear BitcoinTrezor Team!
Thanks for you device! I ordered it (anywhere in a way now) But one question please.
You use nice protected way for enetering PIN code in computer which can be infected by virus/trojan. It's keep my PIN safe from keylogger and mouselogger. But i have read your the Trezor documentation and if i right understand your device has the one vulnerability.
If i lost my trezor, i go to your site "mytrezor.com", to connect new device to bridge and now i should enter seed words through computer. If my computer to be infected a some trojans could catch entered words of seed and immediatly after this steal all bitcoins from BIP32 wallet. Can this happens? As i understand you don't have same protected mode for a word entering?
As workaround of this could be present a seed not by words but by 0-2047 digits. BIP32 words presented as 2^11 digits, right? You could be replace seed words by digits but the recover process could be use your PIN mechanism (random keyboard in trezor's screen).
What do you think?
Thanks!
|
|
|
|
BurtW
Legendary
Offline
Activity: 2646
Merit: 1137
All paid signature campaigns should be banned.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 04:46:03 PM |
|
Dear BitcoinTrezor Team!
Thanks for you device! I ordered it (anywhere in a way now) But one question please.
You use nice protected way for enetering PIN code in computer which can be infected by virus/trojan. It's keep my PIN safe from keylogger and mouselogger. But i have read your the Trezor documentation and if i right understand your device has the one vulnerability.
If i lost my trezor, i go to your site "mytrezor.com", to connect new device to bridge and now i should enter seed words through computer. If my computer to be infected a some trojans could catch entered words of seed and immediatly after this steal all bitcoins from BIP32 wallet. Can this happens? As i understand you don't have same protected mode for a word entering?
As workaround of this could be present a seed not by words but by 0-2047 digits. BIP32 words presented as 2^11 digits, right? You could be replace seed words by digits but the recover process could be use your PIN mechanism (random keyboard in trezor's screen).
What do you think?
Thanks!
If this ever happens to me here is what I would do: Get a new Trezor and set it up from scratch with a new seed (no security problem there) Enter my old seed into wallet32 Immediatly send all the BTC to the new Trezor Yes, I am vulnerable for a brief time there...
|
Our family was terrorized by Homeland Security. Read all about it here: http://www.jmwagner.com/ and http://www.burtw.com/ Any donations to help us recover from the $300,000 in legal fees and forced donations to the Federal Asset Forfeiture slush fund are greatly appreciated!
|
|
|
jl2012
Legendary
Offline
Activity: 1792
Merit: 1111
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 05:01:49 PM |
|
Dear BitcoinTrezor Team!
Thanks for you device! I ordered it (anywhere in a way now) But one question please.
You use nice protected way for enetering PIN code in computer which can be infected by virus/trojan. It's keep my PIN safe from keylogger and mouselogger. But i have read your the Trezor documentation and if i right understand your device has the one vulnerability.
If i lost my trezor, i go to your site "mytrezor.com", to connect new device to bridge and now i should enter seed words through computer. If my computer to be infected a some trojans could catch entered words of seed and immediatly after this steal all bitcoins from BIP32 wallet. Can this happens? As i understand you don't have same protected mode for a word entering?
As workaround of this could be present a seed not by words but by 0-2047 digits. BIP32 words presented as 2^11 digits, right? You could be replace seed words by digits but the recover process could be use your PIN mechanism (random keyboard in trezor's screen).
What do you think?
Thanks!
If this ever happens to me here is what I would do: Get a new Trezor and set it up from scratch with a new seed (no security problem there) Enter my old seed into wallet32 Immediatly send all the BTC to the new Trezor Yes, I am vulnerable for a brief time there... Yes, so this is totally unacceptable
|
Donation address: 374iXxS4BuqFHsEwwxUuH3nvJ69Y7Hqur3 (Bitcoin ONLY) LRDGENPLYrcTRssGoZrsCT1hngaH3BVkM4 (LTC) PGP: D3CC 1772 8600 5BB8 FF67 3294 C524 2A1A B393 6517
|
|
|
TwinWinNerD
Legendary
Offline
Activity: 1680
Merit: 1001
CEO Bitpanda.com
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 05:17:22 PM |
|
@Pelover, well, the seed is entered in a random order. So even if the computer is compromised the attacked still needs to try 24! combinations before cracking your password. So you will have enough time to create a new account as BurtW said.
|
|
|
|
chrisrico
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 06:22:09 PM Last edit: August 09, 2014, 06:33:37 PM by chrisrico |
|
@Pelover, well, the seed is entered in a random order. So even if the computer is compromised the attacked still needs to try 24! combinations before cracking your password. So you will have enough time to create a new account as BurtW said.
In case you didn't catch the factorial operator, that's 6.2044840173323943936 × 10^23 combinations that an attacker has to try. Even if they could try 1 quadrillion combinations per second, it would still take 20 years to exhaust every possibility. Put another way, in order for an attacker to be able to find your seed within 10 minutes (during which time you should easily be able to transfer the coins to a different device), they would need to be able to try 10^21 (1 sextillion) combinations per second.
|
|
|
|
jl2012
Legendary
Offline
Activity: 1792
Merit: 1111
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 06:45:15 PM |
|
@Pelover, well, the seed is entered in a random order. So even if the computer is compromised the attacked still needs to try 24! combinations before cracking your password. So you will have enough time to create a new account as BurtW said.
In case you didn't catch the factorial operator, that's 6.2044840173323943936 × 10^23 combinations that an attacker has to try. Even if they could try 1 quadrillion combinations per second, it would still take 20 years to exhaust every possibility. Put another way, in order for an attacker to be able to find your seed within 10 minutes (during which time you should easily be able to transfer the coins to a different device), they would need to be able to try 10^21 (1 sextillion) combinations per second. This assumes that the first 6.2044840173323943936 × 10^23 - 1 tested combinations are all incorrect, which is extremely unlikely. The probability of this happening is equal to having a correct guess in the first attempt
|
Donation address: 374iXxS4BuqFHsEwwxUuH3nvJ69Y7Hqur3 (Bitcoin ONLY) LRDGENPLYrcTRssGoZrsCT1hngaH3BVkM4 (LTC) PGP: D3CC 1772 8600 5BB8 FF67 3294 C524 2A1A B393 6517
|
|
|
JorgeStolfi
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 06:45:26 PM |
|
@Pelover, well, the seed is entered in a random order. So even if the computer is compromised the attacked still needs to try 24! combinations before cracking your password. So you will have enough time to create a new account as BurtW said.
But if the new Trezor can use those words in random order, why couldn't the attacker do it too?
|
Academic interest in bitcoin only. Not owner, not trader, very skeptical of its longterm success.
|
|
|
jl2012
Legendary
Offline
Activity: 1792
Merit: 1111
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 06:46:25 PM |
|
@Pelover, well, the seed is entered in a random order. So even if the computer is compromised the attacked still needs to try 24! combinations before cracking your password. So you will have enough time to create a new account as BurtW said.
But if the new Trezor can use those words in random order, why couldn't the attacker do it too? Please read this: https://github.com/satoshilabs/docs/blob/master/trezor-user/recovery.rst
|
Donation address: 374iXxS4BuqFHsEwwxUuH3nvJ69Y7Hqur3 (Bitcoin ONLY) LRDGENPLYrcTRssGoZrsCT1hngaH3BVkM4 (LTC) PGP: D3CC 1772 8600 5BB8 FF67 3294 C524 2A1A B393 6517
|
|
|
jl2012
Legendary
Offline
Activity: 1792
Merit: 1111
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 06:48:51 PM |
|
@Pelover, well, the seed is entered in a random order. So even if the computer is compromised the attacked still needs to try 24! combinations before cracking your password. So you will have enough time to create a new account as BurtW said.
In case you didn't catch the factorial operator, that's 6.2044840173323943936 × 10^23 combinations that an attacker has to try. Even if they could try 1 quadrillion combinations per second, it would still take 20 years to exhaust every possibility. Put another way, in order for an attacker to be able to find your seed within 10 minutes (during which time you should easily be able to transfer the coins to a different device), they would need to be able to try 10^21 (1 sextillion) combinations per second. This assumes that the first 6.2044840173323943936 × 10^23 - 1 tested combinations are all incorrect, which is extremely unlikely. The probability of this happening is equal to having a correct guess in the first attempt By the way, the manual should warn the user that after recovery the wallet is not perfectly safe and they should transfer everything to a new wallet I think Perlover's solution is better
|
Donation address: 374iXxS4BuqFHsEwwxUuH3nvJ69Y7Hqur3 (Bitcoin ONLY) LRDGENPLYrcTRssGoZrsCT1hngaH3BVkM4 (LTC) PGP: D3CC 1772 8600 5BB8 FF67 3294 C524 2A1A B393 6517
|
|
|
JorgeStolfi
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 07:05:51 PM |
|
@Pelover, well, the seed is entered in a random order. So even if the computer is compromised the attacked still needs to try 24! combinations before cracking your password. So you will have enough time to create a new account as BurtW said.
But if the new Trezor can use those words in random order, why couldn't the attacker do it too? Please read this: https://github.com/satoshilabs/docs/blob/master/trezor-user/recovery.rst' I have read it but cannot see the answer. The attack that worries the OP may be: hacker installs malicious browser/plugin in many computers and waits for one of the owners to start the recovery procedure. As the victim types the words, the malicious software sends them to the thief, and sends the wrong words to the victim's Trezor, so that his recovery will fail. Meanwhile the thief starts the legitimate recovery procedure with another Trezor, enters the words (garbled, with nulls and all), and gets access to the victim's wallet. (A basic problem of all security systems is that, whatever one must do to get access, someone else with the right information could do the same. Including biometrics. Thus, security always depends ultimately on preventing the bad guys from getting some critical information that the good guys have somewhere.)
|
Academic interest in bitcoin only. Not owner, not trader, very skeptical of its longterm success.
|
|
|
jl2012
Legendary
Offline
Activity: 1792
Merit: 1111
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 07:11:56 PM |
|
@Pelover, well, the seed is entered in a random order. So even if the computer is compromised the attacked still needs to try 24! combinations before cracking your password. So you will have enough time to create a new account as BurtW said.
But if the new Trezor can use those words in random order, why couldn't the attacker do it too? Please read this: https://github.com/satoshilabs/docs/blob/master/trezor-user/recovery.rst' I have read it but cannot see the answer. The attack that worries the OP may be: hacker installs malicious browser/plugin in many computers and waits for one of the owners to start the recovery procedure. As the victim types the words, the malicious software sends them to the thief, and sends the wrong words to the victim's Trezor, so that his recovery will fail. Meanwhile the thief starts the legitimate recovery procedure with another Trezor, enters the words (garbled, with nulls and all), and gets access to the victim's wallet. (A basic problem of all security systems is that, whatever one must do to get access, someone else with the right information could do the same. Including biometrics. Thus, security always depends ultimately on preventing the bad guys from getting some critical information that the good guys have somewhere.) Only the victim and victim's Trezor knows the order of the words. The order is generated by Trezor, only shown on its screen, and never transmitted to the infected computer. The malware may make the recovery fail. However, as the malware does not know the order, it can't recover the wallet either
|
Donation address: 374iXxS4BuqFHsEwwxUuH3nvJ69Y7Hqur3 (Bitcoin ONLY) LRDGENPLYrcTRssGoZrsCT1hngaH3BVkM4 (LTC) PGP: D3CC 1772 8600 5BB8 FF67 3294 C524 2A1A B393 6517
|
|
|
TwinWinNerD
Legendary
Offline
Activity: 1680
Merit: 1001
CEO Bitpanda.com
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 09, 2014, 07:14:04 PM |
|
@Pelover, well, the seed is entered in a random order. So even if the computer is compromised the attacked still needs to try 24! combinations before cracking your password. So you will have enough time to create a new account as BurtW said.
But if the new Trezor can use those words in random order, why couldn't the attacker do it too? Please read this: https://github.com/satoshilabs/docs/blob/master/trezor-user/recovery.rst' I have read it but cannot see the answer. The attack that worries the OP may be: hacker installs malicious browser/plugin in many computers and waits for one of the owners to start the recovery procedure. As the victim types the words, the malicious software sends them to the thief, and sends the wrong words to the victim's Trezor, so that his recovery will fail. Meanwhile the thief starts the legitimate recovery procedure with another Trezor, enters the words (garbled, with nulls and all), and gets access to the victim's wallet. (A basic problem of all security systems is that, whatever one must do to get access, someone else with the right information could do the same. Including biometrics. Thus, security always depends ultimately on preventing the bad guys from getting some critical information that the good guys have somewhere.) The TREZOR will ask you to enter the recovery seed in random order, and the order is only displayed on the trezor. You computer dosn't know what order is right. So even if the attacker has all words, it is pretty much useless. And the entered order is different everytime you are promted to enter it!
|
|
|
|
|